cb92d12ebe8e036b9ebd71dcc80f9187c13bd78ad7d6f4076159c053c4cab16f | Triage

Resubmissions

15/04/2024, 11:24

240415-nhn1asfe2w 10

10/04/2024, 03:17

240410-dth83sce74 10

10/04/2024, 03:17

240410-dtbh8sce69 10

10/04/2024, 03:17

240410-dtaxpsfh4v 10

10/04/2024, 03:17

240410-dtaa6sfh4t 10

19/12/2023, 17:59

231219-wkzhtabga4 10

Analysis

max time kernel
1559s
max time network
1559s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 03:17

Sharing

Report Analysis Logs

General

Target

out.exe
Size

1.0MB
MD5

86b56f37e12c0361800c2dc4a00efaad
SHA1

5a4521d1334b352cfb0abc9ea4c16dba3a683139
SHA256

f55cb3610af39d030231dc72beb53bdfa9f6fe26ff62c72e9af92059ad4b947e
SHA512

e67b7cc98a0fdbcbfa6fc1ece56f8ed25f8bb920e76d1f6bd1e997823220b19ada56a6a99e2e0b60c3ea43053ad4bec9f11b59a8c1cfebae7470a5eff8850a7d
SSDEEP

6144:D9mI/A/bpCQqR5yqL5gbqD8T/ruTEu1U7C711:D9ro/4QqLmqDC/rup+6P

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	2248	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2236	2248	out.exe	28
PID 2248 wrote to memory of 2236	2248	out.exe	28
PID 2248 wrote to memory of 2236	2248	out.exe	28
PID 2248 wrote to memory of 2236	2248	out.exe	28

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 36
  2⤵
  - Program crash
  PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads